Microsoft and Google Coordinate Takedown of $66 Million Cybercrime Platform RedVDS
Threat intelligence shared through the Global Signal Exchange enabled court seizures, server impoundments, and account bans across the US and Europe.
Microsoft and Google have collaborated with international authorities to take down RedVDS, an illicit online marketplace described as a $66 million fraud operation. The platform specialized in selling disposable virtual machines used by malicious actors to carry out phishing, business email compromise, and broader cyberattacks, as reported by TechRadar Pro (https://www.techradar.com/pro/security/microsoft-google-took-down-usd66-million-cybercrime-marketplace-that-sold-virtual-machines-with-free-software).
The disruption was coordinated through the Global Signal Exchange (GSE), a UK-based non-profit founded with Google in 2025 to enable real-time intelligence sharing across the cybercrime supply chain. Other participating platforms include Meta and Amazon.
RedVDS operated as an accessible commercial provider for attackers, pricing basic scam-ready virtual machine instances starting at $24 per month. The service allowed threat actors to provision and quickly delete virtual environments, leaving minimal operational footprint for defensive tools to trace.
According to investigative findings, RedVDS infrastructure was used to target 130,000 organizations between September and December 2025, compromising 191,000 Microsoft email accounts over that four-month window.
Microsoft’s Digital Crimes Unit monitored the marketplace before filing legal actions in US and UK courts in January 2026 to seize RedVDS web domains. Intelligence passed through the GSE enabled Google to pinpoint and suspend connected accounts on its own networks. Law enforcement in Germany impounded physical servers hosting RedVDS infrastructure, while Europol coordinated enforcement actions against European server assets.
Data shared through the GSE also assisted in uncovering a separate tech support fraud campaign that impersonated Microsoft personnel.
“Fraud does not respect company boundaries, and no single organization ever sees the whole picture,” said Emily Taylor, chief executive officer of Oxford Information Labs and co-founder of the Global Signal Exchange. “That is exactly why we built GSE: to give trusted partners a secure way to share what they know, quickly. These two cases are a good example of GSE doing exactly what it was designed to do.”
Both Microsoft and Google confirmed they will continue sharing actionable threat data through the platform.
Sources
Written by
The Company Wire
Inside the companies building what’s next. Reporting on startups, technology, funding and the people shaping them.
